[teamleaderleo]

What broke

A daemon's peer link never finished its handshake when the peer's session list was over the 15 MiB message limit. It failed every ~2 minutes with peer disconnected: handshake timed out after 90s and showed handshaking: true, error: null in host ls the whole time.

We hit this on 2026-10-30. The peer's _acpmux/watch {"withTools": true} reply listed 5241 sessions. Only 426 were the peer's own; the other 4815 were rows it mirrors from its own peers. With tools that came to 17,181,757 bytes, over MAX_MESSAGE_BYTES (15,728,640), so the peer answered -32000 message.too_large. A read-only probe against that daemon got the error in 2.4 s. The same watch without tools is 13,635,206 bytes and still fits.

On the client, the handshake task's link_request_on(MUX_WATCH, ...).await? ended the task without a word. The read loop never looked at the task, so it waited out the 90 s timings.handshake deadline, and the peer then logged Connection reset without closing handshake.

Fix

• Client (peer.rs)
  • When the handshake's watch is refused with message.too_large, it asks again without tools. The link connects, and its rows lack tools, where before it never connected. This works against peers on older builds, so a client update alone unblocks the link without restarting the peer.
  • The read loop now polls the handshake task. When a step fails (refused, or failed on this link), the link ends at once with handshake failed: <the peer's error>, not a silent 90 s timeout.
• Server (server/list_reply.rs)
  • Another daemon's link (view::a_link: served as Peer, or as Web while named acpmux-peer) now gets only this daemon's own sessions in its watch reply (localOnly).
  • The link already drops every mirrored row (peer.rs watch_sessions / is_mirrored_session), so nothing it uses goes away. On the daemon above that cuts the reply from 17 MB to about 1.1 MB.
  • Other clients (CLI, app, Web) still read every row.

Tests (red, then green on cmux-ci test)

Test commit 385deed is red; run https://github.com/manaflow-ai/cmux/actions/runs/41020853418:

• peer::handshake_tests::a_watch_list_too_large_with_tools_is_read_without_them failed with Elapsed (no Connected within 5 s).
• peer::handshake_tests::a_refused_handshake_step_ends_the_link_with_its_error failed with Elapsed (the link kept waiting).
• server::list_reply::link_tests::a_peer_link_watch_lists_only_this_daemons_own_sessions failed with ["m1", "own-chat"] != ["own-chat"].

Fix commit 565ffb9 is green on all three, together with watch_order_tests and the rest of peer:: / list_reply (27 passed); run https://github.com/manaflow-ai/cmux/actions/runs/41021044500. A full cargo test -p acpmux and clippy -D warnings run follows in a comment.

Risk

Low to medium.

• The watch retry only fires on message.too_large.
• Ending the link on a failed handshake step changes how fast a broken link redials (at once, not after 90 s), and the existing redial backoff still applies.
• A peer link's watch list no longer carries mirrored rows. Its client discarded them already, but a third-party client that names itself acpmux-peer would also stop seeing them.

Agent session: agent session

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes peer handshakes that never completed when a peer's watch list exceeded the 15 MiB message limit — the client now retries the watch without tools, and a peer link's watch list now only carries the daemon's own sessions.

• On a message.too_large refusal, the handshake asks for the watch again without tools so the link connects instead of silently timing out. This works against older peers, so a client-side update alone unblocks the link.
• Any handshake that ends without a ready link now ends the link immediately with the reason — a refused step, a panicked task, or a link that dropped mid-handshake — instead of a silent 90 s timeout.
• The server restricts a peer-token link's watch reply to this daemon's own sessions, built from those sessions alone; on the affected daemon the reply shrank from ~17 MB to ~1.1 MB.
• All other clients keep reading every row; a client naming itself acpmux-peer only stays out of presence.

^{Written for commit ab1d1cf. Summary will update on new commits.}

[teamleaderleo]

Owned by an agent session · session

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review ab1d1cf: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr28105 -f ref=acpmux-peer-watch-too-large -f platform=macos -f backend_mode=local

red: cmux-next checks (god files, concurrency, crash safety, l10n); NEW: red check: No literal state roots (per-build isolation S7, cx-is1kf.8) is not red on the base 9e836df; do not merge until green; see lane-rules

[blacksmith-sh]

Found 22 test failures on Blacksmith runners:

Failures

Test	View Logs
test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='', primary='failure')/ test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='', primary='failure')	View Logs
test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='', primary='success')/ test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='', primary='success')	View Logs
test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='blacksmith-16vcpu-ubuntu-2404', primary='failure')/ test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='blacksmith-16vcpu-ubuntu-2404', primary='failure')	View Logs
test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='blacksmith-16vcpu-ubuntu-2404', primary='success')/ test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='blacksmith-16vcpu-ubuntu-2404', primary='success')	View Logs
test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='blacksmith-32vcpu-ubuntu-2404', primary='failure')/ test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='blacksmith-32vcpu-ubuntu-2404', primary='failure')	View Logs
test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='blacksmith-32vcpu-ubuntu-2404', primary='success')/ test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='blacksmith-32vcpu-ubuntu-2404', primary='success')	View Logs
test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='blacksmith-4vcpu-ubuntu-2404', primary='failure')/ test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='blacksmith-4vcpu-ubuntu-2404', primary='failure')	View Logs
test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='blacksmith-4vcpu-ubuntu-2404', primary='success')/ test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='blacksmith-4vcpu-ubuntu-2404', primary='success')	View Logs
test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='ubuntu-24.04', primary='failure')/ test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='ubuntu-24.04', primary='failure')	View Logs
test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='ubuntu-24.04', primary='success')/ test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='ubuntu-24.04', primary='success')	View Logs

...and 12 more test failures. View all on Blacksmith

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Evidence at head ab1d1cf:

• Review. Round 1 (Astra) returned BLOCK: the filter keyed on a_link, and the tools path parsed the whole list. Fixed in 6d36777. Round 2 ran on gpt-6-sol because the Astra lane hadn't produced a verdict after more than 15 minutes. Sol returned BLOCK: the JoinHandle arm missed the panic and Ok(())-without-ready cases. Fixed in 44e6065 (test, red at that commit) and ab1d1cf. Round 3 (gpt-6-astra, high, fast, through review-router) returned SHIP at ab1d1cf.
• Red/green.
  • The handshake tests and the link test are red at 385deed (run 41020853418) and green at the fix.
  • a_handshake_that_ends_without_a_ready_link_ends_the_link is red at 44e6065 and green at ab1d1cf.
• Full cargo test -p acpmux --no-fail-fast plus clippy -D warnings at ab1d1cf. Clippy passes (exit 0). Three test reds, compared against base one by one:
  • hermetic_daemon_guard::every_test_binary_runs_in_the_hermetic_environment fails the same way on base 84705bd (tests/web_image_attachments.rs lacks the hermetic setup), so it is a base red.
  • agent_digest::agent_messages_a_failed_turn_held_go_in_after_the_next_completed_turn (notification timeout) and person_auto_start::auto_start_a_session_never_starts_one_in_another_mode_that_does_not_ask both pass 6/6 at this head and 6/6 on base. Both also passed in the full run at 6d36777. Neither opens a peer link, so they are load flakes and not caused by this PR.
• Other CI reds.
  • cmux-next checks fails on check-state-roots, from cli/help_examples/session.rs:179 (acpmux: every command's --help ends with examples #28013, on base), and on string tables (CmuxHome.xcstrings).
  • release-notary and the Familiar warn job are also red.
  • This PR changes none of the files behind those reds; it touches only six files under cmux-tui/crates/acpmux/src.

[github-actions]

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4103704484701 (dda90181da)
• cmux NEXT nightly 1.0.0-nightly.4104058233901 (5a3b7e1cef)